CVE-2017-7241
Status: ModifiedMedium (4.8)—
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Base score: 4.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.93%
- Percentile among all scored CVEs: 59
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-79
References
- http://openwall.com/lists/oss-security/2017/03/30/4
- http://www.mantisbt.org/bugs/view.php?id=22568
- http://www.securityfocus.com/bid/97253
- http://www.securitytracker.com/id/1038169
- http://openwall.com/lists/oss-security/2017/03/30/4
- http://www.mantisbt.org/bugs/view.php?id=22568
- http://www.securityfocus.com/bid/97253
- http://www.securitytracker.com/id/1038169
Raw JSON (NVD)
Show
{
"id": "CVE-2017-7241",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 3.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 4.8,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 1.7
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-03-31T04:59:00.250",
"references": [
{
"url": "http://openwall.com/lists/oss-security/2017/03/30/4",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.mantisbt.org/bugs/view.php?id=22568",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/97253",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id/1038169",
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2017/03/30/4",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mantisbt.org/bugs/view.php?id=22568",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/97253",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1038169",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the \"Post-installation and upgrade tasks\" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page."
},
{
"lang": "es",
"value": "Una vulnerabilidad XSS en la página MantisBT Move Attachments (move_attachments_page.php, parte de las herramientas de administración) permite a atacantes remotos inyectar código arbitrario mediante un parámetro 'type' manipulado si la configuración de CSP lo permite. Esto se fija en 1.3.9, 2.1.3 y 2.2.3. Tenga en cuenta que esta vulnerabilidad no es explotable si se elimina el directorio de herramientas de administración, como se recomienda en las \"Tareas posteriores a la instalación y actualización\" de la guía de administración de MantisBT. También se muestra un recordatorio para hacerlo en la página de inicio de sesión."
}
],
"lastModified": "2026-06-17T01:23:55.523",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.2.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F75A6F79-C5D5-4612-9976-B54664A5E29E"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.2.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C54ABCB-AD1B-4C34-927A-D9D560EA4C07"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.2.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5F8FB8B-C009-4BF5-B3C3-142FFD0BD5F3"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.2.19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A2E2E1A-B240-476F-8247-67DFFF38D33C"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.2.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3990CAB4-003A-4B10-8516-303C87779C88"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D355450F-4354-4E0B-BA86-A6BCF0672E1A"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5171F015-E110-49CB-8A51-28E067C9B85D"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1C1AFA6-D7C3-4A74-BBB8-2B7234BD03FD"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C22EBC7C-093F-4641-A5DE-E63DD9C0F2BD"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC65E660-1F4A-4040-8C4D-197BD9081E73"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF8D4B34-E00E-4137-8695-6C9C74980DC7"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62C8D0CC-FB77-43B5-8A50-7F5C462E9771"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29B09C56-E71E-4272-A47E-9CC530EEEA5F"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7323557C-F23F-4A83-ADAD-889E3C8B0C74"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11779871-2959-404C-A8A1-C35DACC3EC58"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6BB766F-D8E9-4D1A-A877-2BF75C1E0D05"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDEDA19B-58F9-4416-AF6A-8F1639D665CE"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "26A1E879-1D21-418E-A72E-287C7E977714"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:1.3.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C1519517-765C-4426-8C09-51EBD699EE2B"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B537D8BB-944B-4B92-B48D-0CA5A2D01372"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "541BD5B7-9F88-4B6A-A9D5-3BB182661EC8"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBD43A80-1179-426B-AF21-AE8B29CA1E86"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.0.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F39D6AB1-ECA5-4CE6-BBB3-570758AA715A"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.0.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5202AE86-61A0-4146-BB18-5CD4F38A880C"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.0.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A2965D7-794C-4451-9DB7-B5561B5E3254"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39492D12-1A13-43CE-84A7-F5CCFB87D612"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E6AF670-28C3-4D7E-9EB4-E0B366CE818E"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "021CC8F4-B310-4DBF-9D50-B8A357158E4D"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D73E7205-12E1-4C57-A120-91C4C0760305"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "262EC0CC-0716-4AED-9255-13288A297879"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2550F1FD-5104-4BAA-80F6-C6202D7326B4"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AAFDE5FC-B891-4ACA-BCAB-83EB9D49C91F"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F89D994-7F93-4839-8A57-F4CD633576E8"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2154CE53-2DED-4023-96D5-515468E226B0"
},
{
"criteria": "cpe:2.3:a:mantisbt:mantisbt:2.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83C79C70-F6BE-485D-952A-44E5E9F16D39"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}